package com.lovecoding.redis.redisdemo;

import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Autowired
    SpringSecurityFilter springSecurityFilter;

    @Bean
    public SecurityFilterChain t(HttpSecurity http) throws Exception {

        HttpSecurity and = http
                //配置跨站攻击
                .csrf()
                //禁用跨站攻击
                .disable()
                //配置session
                .sessionManagement()
                //关闭session
                .sessionCreationPolicy(SessionCreationPolicy.NEVER)
                //结束session配置
                .and()
                //配置用户权限
                .authorizeRequests()
                //通过URL 匹配权限路径， 配置权限
                //URL 匹配了  /user/login 这个请求， 则放心
                .mvcMatchers("/user/login").permitAll()
                //其他请求  全部必须登录才能访问
                .anyRequest().authenticated()
                //结束权限配置
                .and();

        //把我们自定义的过滤器添加到  Security 过滤器链路的 前端，， 保证我们的过滤器优先执行
        and.addFilterBefore( springSecurityFilter, UsernamePasswordAuthenticationFilter.class);

        //返回鉴权对象
        return and.build();
    }

}
